back to article UK gains 'adequacy' status on data sharing with EU, but making that stick all depends on how much post-Brexit law diverges

The European Union has formally voted for proposals to give the UK "adequate" status in its data protection laws, allowing data sharing to continue in the post-Brexit world. But the move could prove temporary if the UK were to move too far from the principles of the General Data Protection Regulation (GDPR) in its ambition to …

  1. Ben Tasker Silver badge

    It's a feature not a bug

    > they also mean that existing data cannot be reused for novel purposes

    They really are mistaking a feature for a bug.... If data can arbitrarily be re-used for any old purpose without getting further consent, then it's not really protected is it?

    Good news on the adequacy, but I'm sure we'll find some way to screw it up (followed by politicians blaming the EU for being overly purist about the law or something)

    1. Halfmad

      Re: It's a feature not a bug

      Given the way NHS England are planning to use GP data I'm surprised this hasn't been a warning to the EU already.

    2. Anonymous Coward
      Anonymous Coward

      Re: It's a feature not a bug

      The Germans have good historical reason for being nervous about data being "re-used for novel purposes" - when the Nazis ransacked Magnus Hirschfeld's Institute for Sex Research, besides burning the books they made off with lists of addresses of gay men etc. That data was repurposed to hideous effect.

      It couldn't happen here? Post-Brexit, nothing would surprise me.

      1. gandalfcn Silver badge

        Re: It's a feature not a bug

        And Trumpistan.

        "A hate-filled Texas pastor celebrated the death of a gay person who was accidentally hit by a truck at a Pride parade in Fort Lauderdale, Florida, and told his congregation he hoped all LGBTQ people were killed."

      2. Disgusted Of Tunbridge Wells
        Facepalm

        Re: It's a feature not a bug

        Voting to leave a political and trade union isn't in any way related with becoming Nazi's. Grow up you child.

    3. Citizen of Nowhere

      Re: It's a feature not a bug

      >If data can arbitrarily be re-used for any old purpose without getting further consent, then it's not really protected is it?

      And unprotected is precisely the state those responsible for the TIGRR report want our data.

  2. Teiwaz

    I give it less than three months

    Before adequacy threatens to become inadequate.

  3. Phil O'Sophical Silver badge

    a Brexit goon-squad of Tory MPs

    Ah, nothing like a bit of unbiased reporting, is there?

    Leaving aside the political cracks, "These restrictions limit AI because they prevent AI organisations from collecting new data before they understand its potential value and they also mean that existing data cannot be reused for novel purposes" is actually an interesting point. Much of scientific discovery has come from serendipity, those "I didn't expect that, I wonder why it happened" moments, and it would be unfortunate if this was prevented.

    Instead of prescribing, in advance, the data as collected for specified, explicit and legitimate purposes, effectively trying to second-guess how it will be used, perhaps it would be better to define the things it MUST NOT be used for, and leave any grey issues to be decided by courts if necessary? It's that old difference between "everything not explicitly allowed is forbidden" and "anything not explicitly forbidden is allowed", which has always been a difference between European countries.

    the ruling on the UK being an adequate jurisdiction to share data with would be reviewed on an ongoing basis as UK legislation diverges from EU law.

    Which is exactly how it should be (and applies vice-versa if EU law diverges as well, of course).

    1. Graham Cobb Silver badge

      None of the data that contributed to any serendipitous scientific discovery is personal data. And there are no restrictions on collecting non-personal data.

      It isn't about whether the usage is "forbidden" it is about whether the collector has permission from the data subject. To put it in simple terms that even a Conservative politician can understand: I own data about me personally, and hence I can choose to whom I sell it, for what purposes, and for what price. Any attempt to retain or use personal data without permission of the subject is plain theft.

      1. Doctor Syntax Silver badge

        "Any attempt to retain or use personal data without permission of the subject is plain theft."

        You were doing well up to here but however often theft is used in this context it isn't theft in legal terms because you haven't been deprived of it. Maybe a breach of copyright would be closer. We do need a legally defined simple term to use in this context, however.

        1. Graham Cobb Silver badge

          I chose the word "theft" exactly because of its existing misuse to cover copyright - that is the word to use with people like Tory politicians and media. If they can misapply the term to copyright, we can just as well apply it back again to their activities in our campaigning.

      2. I ain't Spartacus Gold badge

        None of the data that contributed to any serendipitous scientific discovery is personal data. And there are no restrictions on collecting non-personal data.

        Graham Cobb,

        That's definitely not true as regards medical discoveries. All sorts of not-terribly-nice things have been done in the name of "well that might later be useful for some research" - including retaining bits of body tissue, and in some cases whole organs, without telling the families. And that stuff, as well as medical data has definitely been used for valid medical research later.

        Silicon Valley seems to have fallen into the bizarre rabbit hole of trying to hire the greatest minds of a generation in order to target adverts ever so slightly less badly - and it feels like restricting their access to data will have no bad consequences at all. There should be a slightly more nuanced discussion on medical data. While we need good protections in place for people - I think we'd also like to advance medical science - and so might want to consider different compromises (as well as different and better protection) in the medical sphere.

    2. gandalfcn Silver badge

      "a Brexit goon-squad of Tory MPs" is a pretty accurate description. Or haven't you been following current affairs?

  4. Cederic Silver badge

    Yikes

    Actual sense from an EU body. Yes, the UK complies with EU data protection laws, No, it may not in the future. Recognising these things feels entirely appropriate.

    Shame the Germans disagree. I guess they're still upset that we're not helping them fund that mess any more.

    1. Stork

      Re: Yikes

      Perhaps the Germans are envious/annoyed by UK spies’ data slurping?

      1. Anonymous Coward
        Anonymous Coward

        Re: Yikes

        Perhaps the Germans are envious/annoyed by UK spies’ data slurping?

        I suspect that they do it better, they just haven't been caught at it yet.

    2. Anonymous Coward
      Anonymous Coward

      Re: Yikes

      Do you remember the Japanese solder found on a Pacific island still fighting the Second World War? That's you, that is.

      1. gandalfcn Silver badge

        Re: Yikes

        Indeed, it is very telling that so many Brexiteers endlessly bang on about Germany / WWII. They obviously need counselling.

      2. I ain't Spartacus Gold badge

        Re: Yikes

        Do you remember the Japanese solder found on a Pacific island still fighting the Second World War? That's you, that is.

        If he is that soldier - it's not like he's the only one. There's an awful lot of people on both sides still trying to fight the Brexit battle - and I suspect politics would be a lot healthier if most of them would stop. Or at least calm down.

        Then again, there's always the latest fun-and-games over infinitely tiny definitions of racism and micro-aggressions for people to obsess about, so maybe life is still a tiny bit better if they're all still banging on about bloody Brexit instead...

    3. gandalfcn Silver badge

      Re: Yikes

      "Actual sense from an EU body" Which is usually the case, as opposed to BoJoland.

  5. Graham Cobb Silver badge

    You will collect my personal data over my dead body

    These restrictions limit AI because they prevent AI organisations from collecting new data before they understand its potential value and they also mean that existing data cannot be reused for novel purposes

    This statement is absolutely false. 99.999% (or more) of data absolutely can be collected by AI organisations as they wish and can be reused for novel purposes. The only data that cannot be collected is personal data.

    History of temperature changes in Nazeby by the minute can be collected with no restrictions and almost certainly has great value to some future AI. The AI developers just need to get smart about using the data they can collect and stay away from personal data. AI is not just about people.

    1. Anonymous Coward
      Anonymous Coward

      Re: You will collect my personal data over my dead body

      History of temperature changes in Nazeby by the minute can be collected with no restrictions

      But what if that data is then used to determine where I was as I walked around? When does it become "personal"? It isn't black & white.

    2. Doctor Syntax Silver badge

      Re: You will collect my personal data over my dead body

      I doubt it's a matter of getting smart, more a matter of not being greedy because a slurp of personal data will be much more valuable in their eyes then temperature records of Nazeby. What's needed is sufficient enforcement of the DPA to make such data a liability instead of an asset and that's just the opposite of what IDS & co want.

  6. Mike 137 Silver badge

    Realities v. politics

    This decision is officially being made on the basis of compatibility of the legislation, so it's not totally surprising as the UK law actually pretty much replicates the GDPR, with the exception of a couple of egregious and highly questionable departures that have, it appears, been conveniently overlooked.

    However, in reality, as our research has clearly established, practically nobody is actually complying with the legislation anyway, even on its most basics. So the whole exercise would seem to be pure political manoeuvring.

    The purpose of the GDPR and its spin-offs was intended to be protection of data subject rights. That appears to have been entirely forgotten by all concerned.

    1. I ain't Spartacus Gold badge

      Re: Realities v. politics

      Well, it doesn't mean this decision will survive first contact with the enemy. After all the Commission have negotiated two separate deals with the US government, that have been shot down by the ECJ.

      One of the problems, for example, is that the GDPR grants exceptions for governments to do policing and intelligence gathering. However these are only allowed for EU members, so the law is actually tougher on foreign governments over domestic, which could mean the European courts kill this decision off as well. Even before the UK Parliament decides to change anything.

  7. jonha
    Coffee/keyboard

    And another keyboard... gone

    > its [UK's] ambition to be a global tech juggernaut

    Note to self: must really stop reading El Reg while having a cuppa.

  8. Doctor Syntax Silver badge

    I'd like to think that a denial of adequacy would have been the better option here to act as a wake up call. Unfortunately the only actual result would be much frothing at the mouth by all the Brexiteers.

  9. Howard Sway Silver badge

    These restrictions limit AI because they prevent AI organisations from collecting new data

    Well yeah, restrictions are generally created to prevent stuff, and if that is an amazing revelation to you, well let's just say that these companies probably already have you classified in the category "complete idiot".

    It's like complaining that the restrictions on entering your house prevent criminal organisations from collecting new loot. Our information should not just be theirs to take, no matter how easily dazzled idiot lawmakers are by the magic two letters A & I.

  10. John Brown (no body) Silver badge
    Meh

    "adequate"

    That word seems so....inadequate somehow. Almost like you just barely scraped through on the exam.

  11. Claverhouse Silver badge
    Thumb Up

    Worldbeating

    Our new post-Brexit Ranking

    .

    Well. "Bill McNeal is adequate."

    I'm sorry, Bill.

    Sorry? Sorry you weren't singled out and deemed adequate?

    I don't think that's quite the superlative you think it is.

    I beg to differ.

    .

    Newsradio : S003E002

  12. I ain't Spartacus Gold badge

    I give it a week

    Gazing into my crystal ball, I don't think this will last. For the following reasons:

    We might change the law - although I suspect that will take a while.

    The Euroepeans might change their laws - meaning they have to look again at all their external data relationships. This probably even longer.

    The courts in Europe might reject it, as they've done with the last two agreements with the US. I'm guessing at reasonably likely.

    The EU might choose to use it as leverage over some other disagreement. Also quite likely.

    There's already precedent. Despite UK financial regulations not having changed since leaving the EU - the Commission are refusing to grant equivalence (the "equivalent" to "adequacy") - even though they have for the US with a very different system. In this case on the supposed argument that the UK might change things - accepting that they currently comply. And forgetting that equivalence can be revoked at one month's notice. The Commission have also been slowly removing equivalence in some areas from Switzerland, as part of bringing pressure on the Swiss to sign a new deal that replaces a bunch of their exisiting agreements that the EU no longer likes.

    My strong suspicion is that if the two sides can't sort themselves out over implementing the Northern Ireland protocol - something they were supposed to have started talks on in January 2020 to have ready for leaving the transition period in 2021, but only really started in October of last year - then removing adequacy will be one of the levers the Commission will look to. There are provisions in the TCA that allow cross-retaliation, but you have to prove to independent arbitration that they're proportional. Stopping the supermarkets from shipping sausages to the Northern Irish branches is going to be pretty hard to prove as a risk to the integrity of the single market, and so proportionate retalliation might only be a 1p tarriff on battleship cosies. Whereas data adequacy and financial equivalence are purely in the EU's gift, so are prime areas for pressure. But they don't seem willing to offer the financial equivalence, in order to have it to take away, so it becomes useless as a lever. Hence granting data adequacy with minimum fuss perhaps?

  13. xyz Silver badge

    Isn't it about time we monetised our data

    Briefly... We all have a personal data space with our stuff in it. We grant time limted permissions to thrid parties to access bits of that data. Everytime they access a bit (no pun) they pay.

    When the time limit expires, they have to reapply.

    We control our stuff

    No need for data controllers because the data is always ours

    Personal blockchains for accounting purposes.

    Etc

  14. Nifty Silver badge

    Despite some rumours to the contrary, no change is expected to the cookie opt-in popups that you get on every new web page in EU/UK.

    https://www.privsecglobal.com/blog/cookie-consent-after-brexit-what-can-we-expect-in-2021

    So it would be nice if browsers started to have a policy manager that can silently apply the consent to each new site for you, depending on your preferences.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2021